eBPF

eBPF is a technology with origins in the Linux kernel that can run sandboxed programs in an operating system kernel. It is used to safely and efficiently extend the capabilities of the kernel without requiring to change kernel source code or load kernel modules.

→ ebpf.io

Learn

Overview

Overview

Publications

• A light introduction to eBPF by Anais Urlichs - January 20, 2023

• What is eBPF? by SysAdvent - December 23, 2021

• How Netflix uses eBPF flow logs at scale for network insight - Jun 7, 2021

• Facebook, Google, Isovalent, Microsoft, and Netflix announce eBPF Foundation - August 12, 2021

• Facebook, Google, Isovalent, Microsoft and Netflix Launch eBPF Foundation as Part of the Linux Foundation - August 12, 2021

• New GKE Dataplane V2 increases security and visibility for containers - August 19, 2020

Projects

→ ebpf.io/projects

• Cilium

• Falco

• Katran

Tools

• PWRU (Packet Where Are you) - November 2, 2021